# DF-2757 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
In vn_stat the VLNK case adjusts sb->st_mode (|= or &= ~ ACCESSPERMS) BEFORE sb->st_mode is ever assigned - the final sb->st_mode = mode (897) then overwrites the adjustment, so (a) the NOSYMFOLLOW cosmetic mode is dead code that never takes effect and (b) the adjustment reads sb->st_mode while it is still an uninitialized stack value.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain dead-store + uninit-read pattern (the uninit value is discarded, so no disclosure). fix.diff adjusts the local mode variable instead, making the intended symlink-mode cosmetic behavior actually work.

## Threat / reachability
Latent code defect; see VERDICT.md.

## Privilege escalation assessment
n/a (hardening)

## Fix
Adjust mode (the local) instead of sb->st_mode in the VLNK case.

## Kernel references
- `sys/kern/vfs_vnops.c:886`
- `sys/kern/vfs_vnops.c:887`
- `sys/kern/vfs_vnops.c:897`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.